trustedsec/pplfaultdumpbofCobalt Strike BOF that exploits a Windows Protected Process Light bypass to dump protected processes, enabling credential access from LSASS.
Please view that repo for all of the original research and further information This conversion intentionaly does not modify IOC's of the original tool release.
Takes the original PPLFault and the original included DumpShellcode and combinds it all into a BOF targeting cobalt strike.
If you would like to run this in other projects please consider using our BOF runner implementation COFFLoader
Normally I like to use mingw-w64 to build my BOF's but given that this expolit requires modern version of windows 10 to work, it was easier to convert and compile against cl.exe.
You need to start an x64 native visual studio developer prompt. Then from that prompt run makebof.bat
The layout of this code closely matches the original, but the original solution files have been removed as they are unused in a BOF build. Start at entry.c as that is the BOF entry point and where all other .h / .c files are included.
First load PPLFault.cna into cobalt strike
Then in any console run pplfaultdump <pid> <outputpath>
Silhouette is covered by the ELv2 license. It uses phnt from SystemInformer under the MIT license.
Inspired by PPLdump by Clément Labro, which Microsoft patched in July 2022.
ANGRYORCHARD was created by Austin Hudson, who released it when Microsoft patched PPLdump.
PPLFault From Gabriel Landau at Elastic Security
